CVE-2026-78541

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability.

CVSS

No CVSS.

References

Link	Resource
https://www.tp-link.com/en/support/download/archer-be3600/v1/#Firmware
https://www.tp-link.com/us/support/download/archer-be3600/v1.26/#Firmware
https://www.tp-link.com/us/support/faq/5264/

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de inyección de comandos del SO almacenada en el módulo de control parental de TP-Link Archer BE3600 V1. Un atacante adyacente autenticado con acceso administrativo puede almacenar un nombre de perfil manipulado que contiene metacaracteres de shell, el cual se procesa de forma insegura más tarde durante la generación diaria de informes en la nube y puede resultar en la ejecución arbitraria de comandos. La explotación exitosa puede permitir la ejecución de comandos en el dispositivo afectado con un impacto potencial en la confidencialidad, integridad y disponibilidad del dispositivo.

Information

Published : 2026-08-24 19:17

Updated : 2026-10-12 15:10

NVD link : CVE-2026-78541

Mitre link : CVE-2026-78541

CVE.ORG link : CVE-2026-78541

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-78541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T00:00:00+00:00"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "modules": ["parent-control"], "product": "Archer BE3600 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.6 Build 20260617", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T19:17:04.553", "references": [{"url": "https://www.tp-link.com/en/support/download/archer-be3600/v1/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/archer-be3600/v1.26/#Firmware", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5264/", "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A stored OS\ncommand injection vulnerability exists in the parent-control module of TP-Link\nArcher BE3600 V1. An authenticated adjacent attacker with administrative access\nmay store a crafted profile name containing shell metacharacters, which is\nlater processed unsafely during daily cloud report generation and may result in\narbitrary command execution.\n\n\n\n\n\nSuccessful\nexploitation may allow command execution on the affected device with potential\nimpact to device confidentiality, integrity, and availability."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del SO almacenada en el m\u00f3dulo de control parental de TP-Link Archer BE3600 V1. Un atacante adyacente autenticado con acceso administrativo puede almacenar un nombre de perfil manipulado que contiene metacaracteres de shell, el cual se procesa de forma insegura m\u00e1s tarde durante la generaci\u00f3n diaria de informes en la nube y puede resultar en la ejecuci\u00f3n arbitraria de comandos.\n\nLa explotaci\u00f3n exitosa puede permitir la ejecuci\u00f3n de comandos en el dispositivo afectado con un impacto potencial en la confidencialidad, integridad y disponibilidad del dispositivo."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}